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Security against simple eavesdropping attacks is demonstrated for a recently proposed quantum 
key distribution protocol which uses the Fibonacci recursion relation to enable high-capacity key 
generation with entangled photon pairs. No transmitted pairs need to be discarded in reconciliation; 
the only pairs not used for key generation are those used for security-checking. Although the 
proposed approach does not allow eavesdropper-induced errors to be detected on single trials, it 
can nevertheless reveal the eavesdropper’s action on the quantum channel by detecting changes in 
the distribution of outcome probabilities over multiple trials, and can do so as well as the BB84 
protocol. The mutual information shared by the participants is calculated and used to show that a 
secret key can always be distilled. 
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I. INTRODUCTION 

In quantum key distribution (QKD), two legitimate 
users of the system, Alice and Bob, attempt to generate 
a shared encryption key in such a way that the laws of 
quantum mechanics prevent an unauthorized eavesdrop¬ 
per, Eve, from obtaining the key without revealing her 
presence. Restricting ourselves here to systems that use 
pairs of entangled photons, the most common approach 
is the Ekert protocol [l| , which is itself an entangled ver¬ 
sion of the earlier BB84 protocol [2[. An embodiment 
of this approach using photon polarization works as fol¬ 
lows. Alice and Bob each receive half of the entangled 
pair from a common source. Often the source is in Al¬ 
ice’s lab, but it may be under the control of a third party 
(or even under the control of Eve herself). As the pho¬ 
tons arrive, Alice and Bob each randomly choose one of 
two bases in which to make a linear polarization mea¬ 
surement. One basis consists of horizontal and diagonal 
polarization states (\H) and |E)), the other involves di¬ 
agonal states {/^)) and (| \)) polarized at 45° from the 
horizontal and vertical. They then communicate on a 
classical (possibly public) channel in order to compare 
their bases (but not the results of their measurements), 
discarding those trials in which they used different bases. 

In the simplest possible eavesdropping attack. Eve also 
makes a polarization measurement of one photon as it is 
en route to Bob. She must guess randomly which mea¬ 
surement basis to use. If she guesses correctly, measuring 
in the same basis as Alice and Bob, then she gains full in¬ 
formation about the polarization state and therefore has 
complete information about the state of the correspond¬ 
ing key segment. Half of the time she guesses incorrectly, 
in which case her outcome is completely random and un¬ 
correlated with Alice’s result. When she sends on the 
photon, Bob’s results will also be completely randomized 
in the original basis. This disturbance in Bob’s results 
allows Eve’s actions to be revealed. Alice and Bob ran¬ 


domly select a subset of their results for a security check, 
exchanging the results of their measurements as well as 
the basis used on these trials. If Eve intercepts a frac¬ 
tion T] of Bob’s photons she introduces an error rate of 
j between Alice’s outcomes and Bob’s in the security¬ 
checking subset. 

The polarization states have an effective Hilbert space 
of dimension 2, allowing a single bit of the key to be ex¬ 
tracted in each polarization measurement. There have 
been a number of attempts to generalize the procedure 
above with other physical degrees of freedom that have 
higher-dimensional effective Hilbert spaces, thereby al¬ 
lowing more than one bit of the key to be generated 
per photon as well as improved ability to detect 

eavesdroppers. One particularly promising way |iF3 
to achieve this goal is to use the photon’s orbital an¬ 
gular momentum (0AM) [iMl instead of polariza¬ 
tion. The 0AM about the propagation axis is quan¬ 
tized, Lz = Ih, where the topological charge I can take 
on any integer value. If a range of 0AM values of size 
N is used as the alphabet (for example I = 1, 2,..., or 
I = — ..., for even N), then each photon can 

be used to determine up to log 2 N bits of the key. Al¬ 
though in principle such schemes allow unlimited num¬ 
bers of bits per photon, their experimental complexity 
increases rapidly with increasing N. Eor the most part 
we will work in this paper with arbitrary N, but in order 
to make the discussion more concrete we will at some 
points restrict ourselves to an alphabet of size N = S 
(capable of achieving log 2 8 = 3 bits per photon). The 
generalization to higher values of N is straightforward. 

In 0 , an approach to high-dimensional QKD was pro¬ 
posed based on a novel entangled light source 0^i3 that 
produces output with absolute values of the 0AM spec¬ 
trum restricted to the Eibonacci sequence. (Recall that 
the Eibonacci sequence starts with initial values Fi = 1 
and F 2 = 2, generating the rest of the sequence via the 
recurrence relation Fn +2 = + F^.) These states 
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pump a nonlinear crystal, leading to spontaneous para¬ 
metric down conversion (SPDC), in which a small propor¬ 
tion of the input photons are split into entangled signal 
and idler output photons. After the crystal, any photons 
with non-Fibonacci values of 0AM are filtered out. An¬ 
gular momentum conservation and the Fibonacci recur¬ 
rence relation conspire to force the two output photons to 
have 0AM values that are adjacent Fibonacci numbers 
(for example and F^+i). These photons can then 
be used to generate a secret key, as detailed in the next 
section. 

The Fibonacci protocol requires the ability to distin¬ 
guish between single 0AM eigenstates and pairwise su¬ 
perpositions of eigenstates. This cannot be done unam¬ 
biguously on a single trial; however, as shown in [28|, 
an interferometric approach allows statistical discrimina¬ 
tion of the possibilities over multiple trials. Using this 
approach, we show in this paper that the outcome prob¬ 
ability distributions can be built up in such a way that 
eavesdropping alters them in a detectable manner. In this 
way, an eavesdropper can be revealed over multiple trials 
even though it may not be possible to identify errors on 
any individual trial. This is especially important because 
even without eavesdropping there is some probability of 
error in discriminating between states in individual trials, 
due to the non-orthogonality of the relevant superposi¬ 
tion states. This complication must be dealt with in the 
reconciliation stage. BB84 and most other protocols rely 
on the rate of errors in individual outcomes for security, 
but here we must rely on statistical changes wrought by 
the eavesdropper’s actions over many trials. As a result, 
rather than using eavesdropper-induced error rates as a 
measure of eavesdropper detection, it is more appropri¬ 
ate here to use probability-based measures such as the 
disturbance V |^, which is defined in section El 

Section nn reviews the procedure for implementing the 
Fibonacci protocol in the context of 0AM measurements. 
The effect of eavesdropping is examined in section Hill 
Details of the means of dealing with the superposition 
states are described in section lEl with calculations of 
various measures of security carried out in section [V] and 
conclusions in Section [Vll A brief discussion of key recon¬ 
ciliation over a classical channel is given in Appendix A, 
and detailed expressions for the probability distributions 
of outcomes for the protocol appear in Appendix B. 


II. SETUP FOR KEY DISTRIBUTION 

Here, we review the Fibonacci protocol M- The pro¬ 
tocol discussed here is a slightly improved variation on 
the original proposal of 0 , making use of the appara¬ 
tus described in more detail in [^. Note that no trials 
need to be discarded in the scheme described, aside from 
those used for security checking. This is in contrast to 
the original version of the Fibonacci protocol 0 where 
^ of the trials were discarded during reconciliation and 
the BB84/Ekert protocol, where ^ must be discarded. 


The Fibonacci protocol allows multiple key bits to be 
generated per photon. The required basis modulation 
can be done in a completely passive manner, and switch¬ 
ing only has to be done between two fixed bases, so that 
the complexity of the setup increases much more slowly 
with increasiM N than in other OAM-based QKD meth¬ 
ods, such as Q- 

The basic setup is shown schematically in Fig. [TJ The 
source on the left (see 0 for more detail) uses a down 
conversion source and scattering from an aperiodic spiral 
nanoarray 0 ® to create an entangled superposition 
of states with Fibonacci-valued 0AM states in the two 
output directions: 

= i\Fn-l)A\Fn-2)B + |F„_2)a l^n-Os) , (1) 

n 

where the index n runs over the indices of the al¬ 
lowed Fibonacci numbers in the pump beam: \^)pump = 
1^^)' Alice and Bob each receive one photon from the 
entangled pair. In each of their labs is a 50/50 beam split¬ 
ter which randomly directs the photon to one of two types 
of detection stages. The stage labeled “L-type” detec¬ 
tion consists of an 0AM sorter iiil followed by a set 
of single-photon detectors. The 0AM sorter sends 0AM 
eigenstates with different I values into different outgoing 
directions, so that they will be registered in different de¬ 
tectors, thus allowing I to be determined. The other type 
of detection (labeled “D type”) is used to distinguish dif¬ 
ferent superpositions \Sn) of the form 

\Sn) = ^{\Fn-l) + \Fn+l)). ( 2 ) 

The detection of such superposition states can be ac¬ 
complished in several ways One complica¬ 

tion with the D-type detection is that adjacent su¬ 
perposition states, such as ^ (|F^_i) + |F^+i)) and 

^ (|F/+i) + IF/+ 3 )) are not orthogonal, meaning that 
the two states cannot be unambiguously distinguished 
from each other. This adds complications to the clas¬ 
sical exchange and alters the corresponding detection 
probabilities; however we will see below that this extra 
complication is well compensated by increased the key¬ 
generating capacity. Moreover, the degree of complica¬ 
tion does not grow with the size of the alphabet used, so 
that the benefits outweigh the complications by a larger 
amount as the range of I values increases. 

It is necessary to keep the possible key values uniformly 
distributed, so that Eve can’t obtain any advantage from 
knowledge of the nonuniform distribution. To do this it 
will be necessary to make sure that the spectrum of signal 
and idler values is broader than the alphabet of values 
actually used for the key, since the nonorthogonality of 
the superposition states means that measurements can 
broaden the range of outgoing values (see section IIII|) . 

It should be noted that photons are lost from the setup 
only once, in the filtering after the crystal; the spiral 
before the crystal simply redistributes the energy among 
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FIG. 1: Schematic setup for generating cryptographic key 
with Fibonacci-valued 0AM states. 


the available modes through interference effects, with no 
net loss of photons or energy. As a result, event rates 
should be at levels comparable to other entangled photon 
protocols. 

For illustration purposes, we will often restrict our¬ 
selves to the case N = S. Assume that the pump spec¬ 
trum is broad enough to be approximately flat over a 
sufficient span to produce signal and idler 0AM values 
of uniform probability over the range Fmo to 
for some mo- The outcomes for L-type detection (0AM 
eigenstates) that will be used for key generation by Alice 
and Bob are then simply \Fmo), l-Cno+i), • • • l-Cno+iV-i)- 
For example, if the values N = S, mo = 2 are chosen, 
then the utilized states are 


No Eavesdropping: 


|fm,> - 

I t 

State heading State Bob detects 

toward Bob’s lab 

(a) 

Eve’s 

Incoming State measurements Bob’s measurements 




FIG. 2: Outcome probabilities for eigenstates, (a) When 
there is no eavesdropping and Bob measures in the L basis, 
an incoming eigenstate should be detected correctly 100% of 
the time, (b) When Eve measures in the D basis, each eigen¬ 
states can result in two different superposition detections. If 
she sends one of these superpositions on to Bob, the net result 
is that there are now three eigenstates that he could detect. 


III. EFFECT OF EAVESDROPPING: 
QUALITATIVE DISCUSSION 


\Ia), \Ib) = {|F2),|F3),|F4),...,|F9)} (3) 

= {|2),|3),|5),|8),|13),|21),|34),|55)}. 


The outcomes for D-type detection (two-fold 0AM su¬ 
perposition states) used by Alice and Bob for key gener¬ 
ation run from 




^{|Cno-l 


) + l-Cno+l)} 


( 4 ) 


to 


\Smo+N-l) = {\Fmo+N-2) + l-Cno+iv)} • 


( 5 ) 


Detection either of the states \Fn) or \Sn) by Alice will 
correspond to a key value K = F^. Unfortunately, Al¬ 
ice and Bob will not necessarily agree on the same key 
unless further classical information is exchanged to recon¬ 
cile their values. One possible method for reconciliation 
is discussed in appendix A. 


If an eavesdropper is acting on the photon heading to 
Bob, she does not know which type of detection (D or L) 
will occur in Alice’s and Bob’s labs. If Alice detects an 
eigenstate, then the state arriving at Bob’s end should 
be a superposition, whereas if Alice detects a superpo¬ 
sition then the state heading toward Bob should be an 
eigenstate. If Eve makes a D-type measurement when 
Bob’s photon is in an L state or if she makes an L-type 
measurement when Bob’s photon is in a D state, a distur¬ 
bance is made in the statistical distribution of Alice and 
Bob’s joint outcomes, which will become apparent when 
he compares a random subset of his trials with Alice’s. 
In more detail: 

(i) Suppose Eve makes a D-type measurement on a 
photon which is actually in the eigenstate |F^). She will 
detect one of the two superpositions \Fm) + \Fm- 2 ) or 
\Fm) + \ Fm-\- 2 )^ each with 50% probability, and send on a 
copy of it. If Bob receives one of these superpositions and 
makes an L measurement, he will see one of the values 
Tm, Fm- 2 ^ or Fm-\- 2 ^ with respective probabilities of 

In Eve’s absence, he should only see Fm with 100% 
probability (see Fig. 12). 

(ii) On the other hand, suppose Eve makes an L-type 



























4 


measurement on a photon which is actually in the super¬ 
position state \Fm) + \Fm- 2 )- She will detect one of the 
two eigenstates |F^) or |F^_ 2 ), each with 50% probabil¬ 
ity, and send on a copy of it. If Bob receives one of these 
eigenstates and makes a D measurement, he will see one 
of the superpositions \Fm) + \Fm- 2 ), \Fm) + li^m+ 2 ), or 
\Fm- 2 ) + 1 ^ 771 - 4)5 with respective probabilities of 
I (see fig. [3j). Thus, it seems that Bob sees the same 
result whether Eve interferes or not. However, by adding 
an additional interferometric element to the setup, we 
will see (section HV|) that Bob will be able to distinguish 
between the two cases. 



Eve’s 

Incoming State measurements Bob’s measurements 



FIG. 3: Outcome probabilities for superposition states, (a) 
When there is no eavesdropping, an incoming superposition 
state leads to three possible outcomes when Bob makes a 
measurement in the superposition (D) basis: the state can be 
identified correctly with probability |, or it can be misidenti- 
fied as one of the other two allowed superpositions that have 
nonzero overlap with it. (b) When Eve measures in the L 
basis, each of the two possible eigenstates that result can lead 
to two different superpositions. The net result is that there 
are three outcomes that have nonzero overlap with the two 
eigenstates, so that the same probabilities occur as in figure 
(a), unless an addition is made to the apparatus (section llVD . 

It will be desirable to arrange the probabilities of 
the possible outcomes into a matrix. However, as seen 
above, the process of measurement can cause the range 
of states present in the system to spread. States that 
are within the range of our alphabet can lead to mea¬ 
surements outside the allowed range (for example, the 
in-range state |5'^Q+iv-i) can be measured as the out- 
of-range \Smo-\-N)^ since these two states have nonzero 
overlap). Similarly, states that are initially outside the 
desired range can lead to in-range measurements. This 


spreading is greater when Eve is present and introducing 
additional measurements. So to account for this and to 
maintain the uniform distribution of key values, we al¬ 
low states beyond the desired range to propagate in the 
system and include additional rows and columns in the 
probability matrix to describe the probability that the 
measured state is out of range of the allowed alphabet. 
This will be seen explicitly in section [V| and Appendix 
B. Note that we only need to include events in which at 
least one of the legitimate participants sees a value out 
of range; we can exclude events where the measurements 
are out of range for both of them. 

IV. DISCRIMINATING SUPERPOSITION 
STATES 

The discrimination of 0AM eigenstates in the L basis 
is straightforward and simply requires an 0AM sorter. 
Discrimination of superposition states in the D basis is 
more complicated. As shown in [^, the setup of figure 
[4|is capable of sorting the superposition states. A pair of 
photon-counting detectors Cn and Dn is used at the out¬ 
put ports of the final nonpolarizing beam splitters. If Cn 
fires during the key-generating trials, we count that as 
an |5'n-i) detection. Due to destructive interference, Dn 
should not fire for |5'n-i) input, so its firing will count 
as an \Fn) detection. Then the scheme of Appendix A 
is used to reconcile Alice’s and Bob’s trials by classical 
information exchange in order to arrive at an unambigu¬ 
ously agreed-upon key. During the security checks, we 
then look at the distribution of counts in Cn and Dn 
separately in order to detect eavesdropper-induced de¬ 
viations from the expected probability distributions. In 
order to achieve the indistinguishability required for in¬ 
terference, the 0AM of each photon is shifted to zero af¬ 
ter the sorting by a spiral phase plate or by other means. 
Measurements with detectors Cn and Dn^ respectively, 
are equivalent to looking for nonzero projections onto 
the states 

\Cn) = ^{\Fn) + \F^-2)) = i\Sn-l) (6) 

\D„) = F (|F„) - |F„_2)) . (7) 

These two sets of states are also mutually nonorthogonal: 
{Cn\Dni) = —f {Sni,n -2 “ ^^777,77+2) • ) 

There are then multiple possible output states for Alice 
and Bob. Each can measure in the L basis and obtain one 
of the \Fn) states, or they can measure in the D basis and 
register one of the \Cn) or \Dn) states. Their joint output 
probabilities for these states can then be found by taking 
the incoming state, applying the appropriate projection 
operator {\Fn){Fn\, \Cn){Cn\, \Dn){Dn\), and then tak¬ 
ing the inner product of the resulting projection with the 
initial state. The effect of Eve’s intervention on Bob’s 
channel can be dealt with by inserting similar additional 
projection operators representing Eve’s measurements. 
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FIG. 4: A portion of a detection unit for statistically detect¬ 
ing superpositions of 0AM states, analogous to the polar¬ 
ization version of the previous figure. The sorter separates 
different 0AM values, which are then shifted to zero 0AM 
by spiral wave plates or holograms (the yellow circles). From 
the top downward, the 0AM shifters shown change the in¬ 
coming 0AM value by Al = -Fm- 2 , -Fm, -FA+ 2 , -Tm+ 4 . 
Superpositions of the form \Fm) + \Fm-\-2) cause constructive 
interference at the Cm detectors and destructive interference 
at the Dm detectors, while 0AM eigenstates lead to equal 
detection rates at both types. 


These extra projection operators tend to spread the prob¬ 
ability distributions out, causing them to be nonzero for 
combinations of outcomes that previously had vanishing 
probabilities. As a result, Eve’s actions can be revealed 
by these alterations in the outcome probabilities. 


V. MUTUAL INFORMATION AND SECURITY 

For the detection events described in the previous sec¬ 
tions, we may now construct the probability distribu¬ 
tions. 

We begin by making some definitions. Pij will be the 
joint probability that Alice measures outcome i and Bob 
measures outcome j in the absence of eavesdropping. (In 
other words, these are the expected probabilities.) PEij 
will be the observed probabilities for the same outcomes 
in the presence of eavesdropping. The index i labels Al¬ 
ice’s outcomes, i = 1 represents an L-type measurement 
with with the measured value out of range of the de¬ 
sired alphabet, while values 2 < i < N 1 correspond to 
the event that Alice measured in the L basis and found 
state \Fm 0 -\-i- 2 ): similarly, 1 < j < N P 1 represents 
Bob detecting an out-of-range value or measuring state 
\Fm 0 -\-j- 2 ) in the eigenbasis. Value i = N P 2 represents 
Alice making an out-of-range detection in the D basis, 
while values of i in the range V + 3 < i < 3N P 2 repre¬ 
sent Alice measuring in the diagonal superposition basis 
and seeing an event in the C and D detectors. Specif¬ 
ically, i = N P 2k P 3 represents the firing of Cmo+Zc, 


and i = N P 2k P 4 represents the firing of Dmo-\-k^ foi* 
k = 0 ,... V — 1 ; similarly for Bob with j values in the 
same range, pj^^^ and Pj^^ will be the expected marginal 
probabilities, Pij and Pj^^ = with 

similar definitions for P^"^^ and P^^ • 

First, we give the expected probabilities for the states 
in the two beams (before Bob’s measurement) in the ab¬ 
sence of eavesdropping. Columns label Alice’s measure¬ 
ments, while rows label Bob’s. The matrix of outcome 
probabilities then has the form 



Lo Co\ 
P Do)^ 


(8) 


where explicit expressions for the submatrices Pq, Cq, 
and Do may be found in Appendix B. 

The matrices Lq and Dq represent, respectively, the 
events on which both Alice and Bob measured in the L 
basis or both in the B basis. Co represents events in 
which Alice and Bob measured in different bases, one L 
and one B. The factor of | in eq. [ 8 ] is due to the fact 
that each of the four combinations of detection type (LL, 
BB, LB, and BL) has a probability of | in a given trial. 

Now let 77 be the proportion of trials on which Eve 
eavesdrops, i.e. the fraction of the photons on which she 
makes measurements. Assume she also randomly mea¬ 
sures (with equal probabilities) in the L or B basis. Then 
the probability matrix for Alice and Bob’s outcomes will 
change according to: 


Po^P = (l-77)Po+77^^, (9) 


where 


Pe 


1 / P' C' \ 
4 V P' 7 


( 10 ) 


The entries in Pe give the probability that Eve’s actions 
will induce a change in the measured value, given that she 
intervened on that particular trial. The new submatrices 
P', C', P', and F' may be found in Appendix B. We as¬ 
sume for simplicity that Eve only acts on Bob’s channel, 
not Alice’s. The more general case can be treated in a 
similar manner. Note that F' no longer needs to be equal 
to C'^ due to the asymmetry introduced by this assump¬ 
tion. We define the change in the probability matrix due 
to eavesdropping, 


AP = P-Po (11) 

_ vf L'-Lo C -Co \ 

A\F'- D' -Do')' 

The disturbance M introduced by the eavesdropper can 
be used as a measure of how much effect she is having on 
the outcomes of the communication. The disturbance V 
is defined to be 


V = 


y p' 


(13) 
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FIG. 5: The disturbance to the probability distribution, plot¬ 
ted against the eavesdropping fraction, 77 . 


For binary protocols like BB84 the disturbance simply 
equals the eavesdropper-induced error rate, so V is an 
appropriate generalization to protocols for which there 
are more than two possible outcomes per measurement. 
Using the probability matrices of Appendix B, V can be 
readily calculated. From eqs. [12] and [13] it should clearly 
be linear in the eavesdropping fraction 77 , as verified in 
the plot of fig. [5] The disturbance reaches similar values 
to those found in [HI for the BB84 protocol. 

From the probability distributions, the mutual infor¬ 
mation shared by Alice and Bob can also be computed: 

Iab = Ha^Hb- Hab (14) 

= “ X] ^^4 PA,i - ^ PbJ log2 PbJ 

i 3 

+ ^ ^id Pid • (1^) 

d 

The information per trial gained by Eve can also be 
found. First note that the probability that she measures 
in the correct basis is 4. If she guesses the correct basis 
then she can determine the correct value for Bob with 
certainty; if she guesses the wrong basis, she only has a 
50% chance of determining the correct value. So on a 
given trial, her probability of obtaining the correct value 
is |. Therefore, her information gain per trial (her aver¬ 
age mutual information with Alice) is: 

Iae = (prob. that Eve listens in on trial) (16) 

• (probability trial is not discarded) 

• (info, gained per eavesdropping) 

= 7] ■ r(ri) ■ Iab, (17) 

where the fraction r{r]) of trials retained is given in Ap¬ 
pendix B. 

These two information measures are plotted in fig. [ 6 ] 
as a function of eavesdropping fraction 77 . It can be seen 
that the mutual information per trial gained by Eve is 
always less than the mutual information shared between 
Alice and Bob, so that a secure key can always be distilled 
from the exchange. The secret key rate K = Iab — Iae 



FIG. 6 : The mutual information (upper red curve) shared 
between Alice and Bob, and the information gain per trial by 
Eve (lower blue curve) as functions of 77. 



FIG. 7 : The secret key generation rate versus eavesdropping 
fraction 77. 


is shown in fig. [7] as a function of 77 and as a function of 
disturbance in fig. [ 8 ] The slight upturn in the Alice-Bob 
mutual information at large 77 in Fig. [ 6 ] seems to be due 
to the fact that Eve’s interference causes the outcomes 
to be more spread out (there are more nonzero entries 
in Pe than in Pq), and more uniform distributions lead 
to increased information gains per measurement. Due to 
the concave shape of the binary entropy function, such 
an effect can also happen in schemes using binary qubits, 
if the error rate is able to exceed 50%. 


VI. CONCLUSIONS 

In this paper, we have constructed the joint probabil¬ 
ity distributions for Alice and Bob’s measurement out¬ 
comes in the Eibonacci protocol, both in the absence of 
eavesdropping and for the case of simple intercept-resend 
attacks. Eor the case of three bits per photon, it has 
been demonstrated that a secure key can be distilled and 
that the eavesdropper’s presence can be revealed. Eor 
larger alphabets (more key bits per photon), the mutual 
information shared by Alice and Bob increases logarith¬ 
mically with alphabet size, while the amount of classical 
information that needs to be exchanged stays constant. 
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FIG. 8: The secret key rate k, as function of disturbance, V. 


It remains for future investigation to see how the protocol 
behaves under more sophisticated eavesdropping attacks. 
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Appendix A: Reconciliation 

In order for Alice and Bob to determine each other’s 
values they must exchange additional information on a 
classical side channel. Here, a brief description is given 
of one way to do this. Other methods are also possible. 
It is necessary to make sure that no eavesdropper can 
obtain the key from the classical exchange alone. 

If Eve intercepts both the classical and quantum ex¬ 
changes, and if she can store the photon from the quan¬ 
tum channel until she has read the classical channel, then 
she has complete information about the bit, just as Bob 
does. However, the disturbances she introduces will then 
signal her presence, causing the tainted key to be dis¬ 
carded. This is identical to the case in the BB84 or Ekert 
protocols. 

However, in the Eibonacci case a larger classical ex¬ 
change is required, which reduces the average amount of 
information about the key that remains secret. This re¬ 
duces the key generation capacity per photon, partially 
canceling the advantages from the larger Hilbert space. 
But even in the worst case the classical exchange can be 
chosen such that the amount of classically revealed in¬ 
formation remains less than the amount of information 
generated by the quantum exchange, allowing the dis¬ 
tillation of a secure key [ 2 ^. Eurthermore, the amount 
of revealed information is independent of A, while the 
total information from the quantum exchange increases 
with increasing alphabet size like log 2 A; thus this infor¬ 
mation leakage becomes more and more negligible with 
increasing A, as compared to the total information. 


When both experimenters measure in the L (eigen¬ 
state) basis, they should (in the absence of eavesdrop¬ 
ping) always receive adjacent Eibonacci numbers, say 
Fn and although initially neither of them knows 

whether they have the lower or higher value in the pair. 
In order for them to determine this, they must each ex¬ 
change one bit of information over the classical channel. 

One possible way to do this (illustrated for the case 
A = 8, mo = 2), is for Alice first to send either a 0 or 1 
to Bob in the following manner: 


Alice has: 

2 

3 

5 

8 

13 

21 

34 

55 

Alice sends: 

0 

1 

1 

0 

0 

1 

1 

0 


Once Bob receives this information he can determine Al¬ 
ice’s value, since he already knows it has to be one of 
the two values adjacent to his. Alice’s value can then be 
used as the key value. Eor arbitrary A, the probability of 
guessing the correct value based on the classical exchange 
alone decreases with increasing A: P = ^. 

Half of the time, Alice and Bob make opposite types 
of measurements, one L and one B. Suppose, for ex¬ 
ample, Alice measures the value P5 = 8 in the L ba¬ 
sis, while Bob measures in B. In principle, he should 
receive the superposition state (|5) + |13)); however, 
since non-orthogonal states can not be uniquely distin¬ 
guished, there is a 25% chance that Bob will instead mea¬ 
sure the superposition ^ (|2) + |5)) and 25% that he will 

find ^ (113) + |34)). To arrive at an unambiguous value 
shared by both participants, there are several possible 
procedures. One possibility (again described for the case 
A = 8, mo = 2) is for Alice to send Bob two bits of 
information, according to the following table: 


Alice has: 

2 

3 

5 

8 

13 

21 

34 

55 

Alice sends: 

01 

10 

00 

01 

10 

00 

01 

10 


Bob then knows Alice’s value unambiguously, so that 
they can agree to use her value as the key segment; again, 
there is no need for Bob to send any classical informa¬ 
tion in this case. As A increases, the number of key bits 
generated per photon grows but the amount of classical 
information exchanged remains fixed. 

Einally, Alice and Bob can both make a B measure¬ 
ment. Suppose that Alice sends two bits of classical in¬ 
formation, which could be: 


Alice has: 


52 

53 

54 

55 

56 

58 

59 

5io 

5ii 


Alice sends: 

00 

00 

01 

01 

10 

10 

11 

11 

00 

00 



( 20 ) 


Examination of the probability matrices (eqs. [27ll28|) 
makes clear that, armed with knowledge of his own su¬ 
perposition, Bob can unambiguously determine Alice’s 
value, while an outsider eavesdropper on the classical 
channel again has a decreasing probability of guessing 
the correct value as N increases. Once Alice and Bob 
agree that Alice has superposition \Sn), they then adopt 
the value as the key value. 
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FIG. 9: The labeling of rows and columns is shown for the 
probability submatrices. Different rows correspond to differ¬ 
ent outcomes for Bob, while columns correspond to Alice’s 
outcomes. The first row and column label detection of out¬ 
comes not included in the range of the alphabet used for key 
generation. The remaining rows and columns of Lq label al¬ 
lowed eigenstates, and those of Do alternately label Cn and 
Dn detection events signalling allowed superposition states. 
Similarly, Co has eigenstate events running horizontally, with 
Cn and Dn events vertically. Lq, Co, and Do are respectively 
(iV+l)x(iV-|-l), (iV-M)x(2iV + l), and (2Ar +1) x (2iV +1) 
matrices. 


Appendix B: Probability Matrices 

Here we give explicit expressions for the joint proba¬ 
bility distributions seen by Alice and Bob for their out¬ 


comes, with and without eavesdropping. See section [Vl 
for the relevant definitions. The labeling of the rows and 
columns is shown in fig. [9l 

To compute the probabilities in the absence of eaves¬ 
dropping, first consider the projections of the biphoton 
state \ 2 p) after the crystal (eq. [T]) onto the states that 
can be detected at the various detectors on Alice’s side: 


= \Fr,)AA{Fn\i>) 

(21) 

= (l-Pn-l)B + l-Fn+l)^) 

(22) 

= \Dn)AA{Dn\^l>) 

(23) 

= -\\Dn)A 

(24) 

X {\Fn-3)B + F2\Fn-l)B + ^n+l)s) 

1^-1) = \Cn)AA{Cn\^} 

(25) 

= -^\Cn)A {\Fn+l)B “ 

(26) 


with similar expressions for the states ), )? 

on Bob’s side. Then (up to an overall constant 
that can be fixed by the requiring the probabilities to 
sum to one) the matrix for the probabilities of joint de¬ 
tections by Alice and Bob can be built up entry by en¬ 
try by computing the various products ), for 

X,Y = C,D,F. We give here the results for TV = 8; the 
generalization to larger N is straightforward. The results 
are: 
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Eve’s measurements will alter Bob’s outcome probabil¬ 
ities. If T] be the proportion of trials she intercepts, then 
the probability matrix for Alice and Bob’s outcomes will 
change according to Pq P = t^Pe + (1 — 77)Po, where 
Pe describes the change in probability due to Eve’s inter¬ 
vention on a given trial. The various joint probabilities 
are computed as before, but with additional projection 
operators inserted into Bob’s line to represent Eve’s ac¬ 
tion. Eor example, when Alice and Bob measure in the 
L basis and Eve measures in the D basis, the probability 
that Alice detects Fp and Bob detects P^ has extra terms 


added to it of the form 

(29) 

m 

+ {^i\Kj\{Dm\Fn)?} ; 

these extra terms correspond to the possible outcomes 
of Eve’s measurement. Similar expressions apply to find 
the rest of the probabilities. The net result (for N = S) 
f L' C \ 

is: Pe ~ \ \ pf ]jf ] ^ where the new submatrices are 
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Note that the matrix is no longer symmetric due to the line but not Alice’s. In particular, this means that F' is 

fact that we are assuming Eve has access only to Bob’s not equal to the transpose of C'. 


[1] A. K. Ekert, Phys. Rev. Lett. 67, 661 (1991). 


[2] C. H. Bennett, G. Brassard, in Proceedings of the IEEE 



10 


International Conference on Computers, Systems, and 
Signal Processing, Bangalore, 175 (1984). 

[3] D. BruB, Phys. Rev. Lett. 81, 3018-3021 (1998). 

[4] H. Bechmann-Pasquinucci, A. Peres, Phys. Rev. Lett. 85, 
3313-3316 (2000). 

[51 M. Bourennane, A. Karlsson, G. Bjork, Phys. Rev. A 64, 
012306 (2001). 

[ 6 ] N. J. Cerf, M. Bourennane, A. Karlsson, N. Gisin, Phys. 
Rev. Lett. 88 , 127902 (2002). 

[7] S. Groblacher, T. Jennewein, A. Vaziri, G. Weihs, A. 
Zeilinger, New J. Phys. 8 , 1 (2006). 

[ 8 ] A. Mair, A. Vaziri, G. Weihs, A. Zeilinger, Nature 412, 
313 (2001). 

[9] A. Vaziri, G. Weihs, and A. Zeilinger, Phys. Rev. Lett. 
89, 240401 (2002). 

[10] D. S. Simon, A. V. Sergienko, New J. Phys. 16 063052 
(2014). 

[11] S. Franke-Arnold, L. Allen, M. Padgett, Laser Photon. 
Rev. 2, 299313 (2008). 

[12] L. Allen, M. W. Beijersbergen, R. J. C. Spreeuw, J. P. 
Woerdman, Phys. Rev. A 45, 8185-8189 (1992). 

[13] G. Molina-Terriza, J. P. Torres, L. Torner, Nat. Phys. 3, 
305-310 (2007). 

[14] D. S. Simon, J. Trevino, N. Lawrence, L. dal Negro, A. 
V. Sergienko, Phys. Rev. A 87, 032312 (2013). 

[15] S. F. Liew, H. Noh, J. Trevino, L. Dal Negro, H. Cao, 
Optics Express 19, 23631-23642 (2011). 

[16] J. Trevino, H. Cao, L. Dal Negro, Nano Letters, 11, 2008- 


2016 ( 2011 ). 

[17] J. Trevino, S. F. Liew, H. Noh, H. Cao, L. Dal Negro, 
Optics Express, 20, 3015-3033 ( 2012 ). 

[18] L. Dal Negro, N. Lawrence, J. Trevino, Optics Express 
20, 18209 (2012). 

[19] N. Lawrence, J. Trevino, L. Dal Negro, J. of App. Phys. 
Ill, 113101 (2012). 

[20] 1. Csiszar, J. Korner, IEEE Transactions on Information 
Theory, Vol. IT-24, 339-348 (1978). 

[21] N. Liitkenhaus, Phys. Rev. A 54, 97 (1996). 

[22] J. Leach, M. J. Padgett, S. M. Barnett, S. Franke-Arnold, 
J. Courtial, Phys. Rev. Lett. 88 , 257901 (2002). 

[23] G. C. G. Berkhout, M. P. J. Lavery, J. Courtial, M. 
W. Beijersbergen, M. J. Padgett, Phys. Rev. Lett. 105, 
153601 (2010). 

[24] M. P. J. Lavery, D. J. Robertson, G. C. G. Berkhout G. 
D. Love, M. J. Padgett, J. Courtial, Optics Express 20, 
2110-2115 (2012). 

[25] Y. Miyamoto, D. Kawase, M. Takeda, K. Sasaki, S. 
Takeuchi, J. Opt. 13, 064027 (2011). 

[26] B. Jack, A. M. Yao, J. Leach, J. Romero, S. Franke- 
Arnold, D. G. Ireland, S. M. Barnett, M. J. Padgett, 
Phys. Rev. A 81, 043844 (2010). 

[27] D. Kawase, Y. Miyamoto, M. Takeda, K. Sasaki, S. 
Takeuchi, Phys. Rev. Lett. 101, 050501 (2008). 

[28] D. S. Simon, C. Fitzpatrick, A. V. Sergienko, Phys. Rev. 
A 91, 043806 (2015). 



